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NATIONAL FOREIGN ASSESSMENT CENTER 


WASHINGTON, D. C. 20505 


16 October 1979 


in | MEMORANDUM FOR: Lessaeeeee dl Chairaan 
NFIB Working Group on Compartmentation 


Chief, Requirements and Evaluation Staf£/NFAC 


SUBJECT » APEX Security Manuals for Government/Industry--CIA 
x1 Comments = 


REFERENCE : Walsh Memo to Working Group_re APEX Security 
Manuals, 28 September 1979[___] 25 


1. This memorandum contains the comments of the NFAC, the 
D/S&T, the D/O, and the D/A, respectively, on the draft APEX manuals 
for government and industry (annexes I and II to the APEX report), 
dated May 1979. Several comments are rather general owing to a lack 
of specificity in the text of the manuals. Presumably these general 
guideline portions of the manuals will be spelled out prior to 
further NEIB consideration of the manuals as called for in the minutes 
of the 58th NFIB meeting, 25 September 1979.[ | 25 


2. A number of the NEAC comments, which are with one exception 
limited to the government manual, relate to the potential additional 
resource burden of accounting for APEX documents and the role of the 
Senior Intelligence Officers (SIOs). The D/S&T defers to the approp- 

. riate program managers for comments cn the industry manual. The D/O 
x1 focuses on ch Jeatecery The D/A's comments range widely from 
- ae impact on the reproduction of cables to the impact on OC's ComSec 
p efforts. a 2 ‘ 


25 
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Directorate Positions. -- NFAC: 


3. The NEAC comments do not address the sanitization and 
decompartmentation guidelines, which are the most critical issue for 
jt and other producers of finished intelligence. Also, there are 
concerns within NEAC about the abolishment of [____] but the NFAC 25 
defers to the program manager and the security specialists for de- 
tailed conments. — 


4, The industry manual makes no mention of Contracting 
Officers' Technical Representatives (COTRs). Because they often 
are more involved than contract officers it would seem that they 
too should be included in the text, with guidance provided on 
handling materials, among other special considerations. [| 25 


5. There is a generalized concern in NFAC that the govern- 
ment manual wording appears headed to the control of SCI raw-data 


-and processed-information documents, especially cables such as 


. 


those issued by the National Security Agency, in the manner of 


those that are "green-sheet-covered" Top Secret. This would 


.impose a very serious problem for the Center. One office recently 


undertook a small study of the. implications of controlling SCI 


ables through its registry system. The study indicated a need 


J 


‘for a minimm of five additional people to provide satisfactory 


control of the systen including the reproductior, distribution, and 


-€ile maintenance of this document flow. This resource issue needs 
careful | | as ways are sought to impose more strict document 


control. 


6. NEAC/OCR has reviewed the government security manual and 
finds that it causes immediate problems for two new systems: its 


Automated Document Storage and Retrieval (ADSTAR) system and SAFE. 


OCR will begin in November 1979 the conversion of the last three 
years (CY 1977-79) of its document holdings from present format 
to the ADSTAR blip-coded 16mm microfilm. The APEX manual suggests 
that there could be changes in the requirements for the handling 


'- of the SCI documents now on file. Therefore, OCR needs to know 
‘what these changes will be before it undertakes a costly conversion 


process that may have to be redone. .. APEX poses other problems for 
ADSTAR. They are raised below, along with the specific comments of 
the other NFAC entities. 
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a. Page 1, INTRODUCTION. This manual needs a better 
explanation of specifically what APEX is. It would be use- 
ful to say what special access systems are covered. For 
example, "APEX was established to control what has been re- 
cently known as Sensitive Compartmented Information, and 
specifically covers...." In this paragraph, and throughout 
the manual, the effort to keep the classification of the 
manual at the lowest possible level had led to a lack of 
clarity. The second paragraph of the Introduction talks about 
classification of terms; the manual itself is not properly 
-Classified--it needs portion markings or a general state- 
ment. Paragraph three suggests that changes may become 
necessary in the handling of what are now termed SCI materials. 
Any-substantial change in the handling of these materials 
could have a major change on OCR's central document respository 
and bibliographic index. (This is a general problem for all of 
NFAC but specifically for OCR.) It is particularly important 
that OCR understands how present SCI materials will be handled 
in the future as it begins the conversion of the three most 
recent years of document holdings for ADSTAR. 


pb. Page 2, Organizational Structure. A clear definition. 
for Senior Intelligence Officers (SIOs) is needed. In the 
unified and specified commands, there are SIOs at a variety 
of levels. In contrast, CIA has only one SIO--the (Deputy) 
. Pirector of NFAC who advises the DCI on questions of 
--compartmentation. This factor becomes extremely important 
when an SIO, for example, can waive certain investigative 
requirements (VIII.c) if he wishes to authorize an individual 
access to the APEX system prior to the completion of a full 
investigation. The SIO also has a number of other important 
_- powers. Unless the SIOs' responsibilities are more strin- | 
gently defined and the level at which they operate, the S10s 
in a number of agencies and departments may well have far 


more authority than, necessary. 
c. Page 2, Paragraph 8. It would be useful to know 
‘whether APEX Control Facilities are bounded physically or 
_ organizationally. 2 eels 
de Page 2, Penultimate Paragraph. The difference 


between the ACO and ASO is not clear. Suggest rewording to 
' gay: “Because of the separate responsibilities of the ACO 
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and the ASO [see page 8], it is preferable that these 
positions not be held by the same jindividual....""_ At what 
organizational level will they be located? 


e. Page 3, Second Paragraph. This paragraph indicates 
a variety of different compartments in APEX but only one, 
is addressed in the manual. The sigificance and 
“Implications of the other compartments should be addressed. 
(See relevant D/O comments below.) The NFAC suggests that 
some examples be provided for use of category terms, code- 
-words, and special designators. 


f. Page 4, Paragraph c. Should an annual approval 
review for accesses be required, NFAC would have to cope 
with more than 8,000 clearances under today’s systems. 

Most recently, such an exercise required four man-mon 
of one security officer's time in addition to the time: 
expended by the NEAC components. 

_g. Page 4, Paragraphe. It would appear impossible 
for anyone in OCR (or other processing units) to accoumt for 
vali APEX documents under his/her control or cognizance should 
‘al. SCI documents retroactively be converted to APEX. For 
exinple, a number of supervisors up the line have respon- 
sibility for the central library of 11 million documents. 


-Qner offices in NEAC will have similar problems becaus2 the 


qraterials are held in a large mumber of safes or cabinets 
under the control of individual analysts. Csi 


h. Page 4, Paragraph g. Under existing procedures 
for granting access to canpartmented information, the 
Department of Defense and the unified and specified commands 
demand access to compartmented information down to relatively 
low-level units. The need to know for many of these units 
is very questionable.. The NFAC would, therefore, favor even 
more restrictive language in this paragraph; otherwise 
sensitive information would continue to flow to levels that 
do not require it. 

i. Page 5, Paragraph h. The two phases of APEX- 
GENERAL access seem unnecessary, and poorly defined. A 
computer technician can have access to more APEX material 
than a file clerk. The establishment of a general access 
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seems questionable. The file clerk, document control 

clerk, and computer technician--with broad access to a 
variety of APEX documents--present a greater security risk 

_ than does the analyst with full access to a limited number 
of documents. (If phases are to be differentiated, "groups" 
or "classes" seem to be more appropriate terms.) 
j. Page 8, Paragraph VII.a.2.§3. The ACO is identified 

as the exclusive controi point for receipt and dispatch. 

This is almost: impossible in an operation as large as OCR. 
Suggest rewording to say that the ACO ensures the proper 
receipt and dispatch.... Additionally, note if, as stated 
previously on page 2, the ACO and ASO are not the same 

- individual, a great duplication of effort will result. The 
ACO duties 4 and 5 are parallel to ASO duty 2. 


k. Page 10, Paragraph d. There are formidable 
- political and perhaps legal obstacles to obtaining agree- 
ment from other agencies and departments on administering 
polygraph tests to individuals having access to APEX 
material. The NFAC believes, however, that agencies should 
- have a reserve power to insist upon administering poly-- 
. graph tests when derogatory information or inconsistencies 
. arise that could impact on an individual's security status. 
The right to selective use of the polygraph on individuals 
having access te APEX information would be a minimal safe- 
guard if the US government is to stem the current flood of 


security leaks.[ | 


1.. Pages 9-16. . The almost seven pages on security 

standards, with the heavy emphasis on investigation and 
reinvestigation, offer a stark contrast to the two pages 
on security education. All the checks and controls in a 
- security control system are for naught if the people within 
the system do not understand and participate in the system. 
This requires a vigorous program of security education and 
awareness at all levels. 


m. Page 18, Paragraph XI.a., An "APEX control organiza- 


tion" is identified. It should be described and stated where 
it is located. 
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n. Page’ 18, Paragraph XI.b. Will the central record of 
APEX cleared personnel be a modification of SPECLE? OCR is 
using SPECLE data as the basis for its security access 
x package, and changes to SPECLE could require changes in the 
“OCR software for this package.[ 25 


: 0. . Page 19, Paragraph XII.a. In the last sentence, 
_Suggest deletion of ‘where normal management...sufficient." 
"Inclusion permits judgnents to be made as to the sufficiency 
~ O£ “normal ‘management and safeguarding procedures" to pro- 
‘tect intelligence--an incomprehensible situation. If compart- 
_.teented information is presented, it should be identified as 
25X1 such. 


. gop. Page 19, Paragraph XII.b. The definition of compart- 
mentation is confused by the inclusion of sanitization as a 
_ ferm of decompartmentation. It would.be preferable to use 


_the. definitions the sanitization and decor artmentation panel | 
5X4 “(Pask Group 4) developed this past a 25 


_ oJhis paragraph states "To the extent possible, 
“materials protected under the APEX Security Control System 
will be decempartmented." The manual does not, however, 
discuss bibliographic citations (numbering about 3 million), 
yam important concern of OCR--particularly in light of the 
‘ gurrent proposal that OCR's bibliographic index be reviewed 
Jas a possible Commmity system. The NFAC recommends that 
-this manual contain a statement on bibliographic citations, and 
“ghat. this statement indicate that bibliographic citations 
for automated indexes can be handled outside the APEX system 
oyiz., that the citations themselves do not have to be treated 
x1 . as APEX materials. 


-@. Page 21, Paragraphs XIII.a. and XIII.b.1. In the 
“€irst, it would seem appropriate to include a statement about 
derivative. classification, and the classification decisions of 
“others. As for the second, a ‘statement should be added .to 
the last ‘sentence to indicate ‘that each article ina periodi- 
_-cal should also be marked as a separate document . 25» 
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vr. Page 21, Paragraph XIII.b.2. Recommend that the 
"HANDLE VIA..."' marking not be placed on each page. It would 
“serve only to add more clutter to the information presented. 
Also suggest "back page, and first page'' read "first page, 
‘and back page." ney 


~ -s. Page 21, Paragraph XIII.b.4. The second sentence 
should be revised to indicate that control numbers are not 
necessary when a document has a unique identifying number. 

_ When a document has more than one number by which it can be 
identified, storage and retrieval are complicated. This is 
extremely important--it has cost implications as well as 
document control as and would be an improvement on 

_ the present system. 


;t,? Page 22, Paragraph 5. Suggest deletion of ambigu- 
ous "when it is necessary.” 


u. Page 22, Paragraph 6. The NFAC has some concern re- 
garding the reason for extended classification; can this manual 
be used as the reference, or should the_reason be more 
closely tied to Executive Order 12065? 


v. Page 22, Paragraph 8. Will it be necessary to 
remark current files? Will future acquisitions of raw 
traffic necessarily be treated in this fashion? Suggest 

the second sentence read "The classification and handling 
controls for such material...." 


-w. Page 23, Paragraph XIII.c.5. The "TO BE RETURNED..." 
marking is not as clear as the present "PROPERTY OF U.S. 
GOVERNMENT..." marking, which also includes a phone mmber{ | 


x. Pages 24 and 25. OCR, in particular, has concern 
about the reproduction and accountability of Top Secret (TS) 
documents. For years the control of collateral TS documents 
has been governed by tight accountability. If TS-compart- 
mented materials are to be treated also with this tight 
accountability, OCR's costs of handling these materials will 
sizably increase unless there is a decrease in the volume 
of this material. (OCR currently disseminates about 900 NSA 
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hard-copy TS documents a month; in the process it must re- 
produce a number of copies of each document.) Some sort of 
reasonable modification of these guidelines is necessary in 
order for OCR to disseminate and to provide document service 
effectively. 


If strictly adhered to, this requirement would 
encumber the production process, in that most analysts at 
one time or another clip and paste. 


y. Page 24, Paragraph XIII.f. Suggest first sentence 


read "...has been served, APEX-controlled material will be 


destroyed as prescribed by existing record control policy and 
in a manner....'" 


z. Page 25, Paragraph 3. The requirement for random 
audits of non-TS and non APEX documents appears to 
require that ISG maintain an inventory of all APEX materials 


filed in its biogravhic and organizational files--a totally 


jzpossible task. [| 


aa, Page 25, Last Paragraph. This could be worded 


more Clearly to say something like: "Dissemination records 
i a 


@re not required for the normal distribution and processing 


of raw intelligence APEX data provided it remains under the 


centrol...."' Moreover, illustrations of "raw intelligence 


_ data" should be provided. 


‘bb. Page 27, Paragraph c. It would seem that among 
the elements on each microfiche readable without ma ifica- 
tion would be the APEX control and copy numbers. pal 


cc. Page 27, Paragraph d. The requirements for target 
ges and extra labeling of microfilm containers will slow down 
the production of film for ADSTAR, whose basic purpose is to 
provide faster service. The value of target pages is question- 


‘able for any microfilm; it is particularly so for ADSTAR. Film 


will be stored in cassettes. that are mounted in storage modules. 
Viewing of this film is only through a computer-assisted re- 
trieval process, which limits an individual's access to only 
those documents for which he/she has a clearance. 
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dd. Page 26, Paragraph XIV.b. Suggest the more general 
term "opaque" vice "metal.'' New materials are now in develop- 
ment. | 


' The requirement for marking the outside of those 
microfilm cassettes that are stored in the ADSTAR modules | 
-geems unnecessary also. It provides no further security 
protection for this system. ] 


ee. Page 31, Paragraphs XVII.b.2. and 3. Although this 

is a continuation of similar TKH policy the NFAC does not 
believe it to be the best policy nor does it reflect the 
‘current concern over disclosures. If APEX is designed to 
permit greater noncompartmented dissemination, then infor- 
mation that remains in APEX compartments should be protected 
to the greatest degree possible. Even though these are after- 

-. the-fact procedures, they should be more specific as to the 
responsibilities of the ASO. Ideally, all disclosures and 
‘compromises, real or suspected, should be reported and inves- 
tigated. [T] . : 


Directorate ‘Positions. -- D/S§T: 


7, ° The comments of the D/S&T are general; it is assumed 
that most of the specific details will be worked out prior to 
‘the approval of these manuals. 


a. It is recommended that adoption of the APEX 
security manuals be on condition that the standards and 
responsibilities be defined more fully--with NFIB approval 
‘required--before their implementation. For example, Senior 
Intelligence Officers (SIOs) are responsible for implementing 
the procedures in the APEX system but "SIOs" are not further 
defined or identified. a 


b. It is further recommended that security guides 
-and implementation handbooks be published by the APEX 
- control organization for each topical area, e.g., 
as the terms become better defined, and in concert with 
commmity implementation. Each of the present sensitive, 
compartmented programs are handled in special channels. 
Documents in these programs are now separately stored, . 
with a full-time custodian responsible for logging, 
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filing, and granting access to the file by those formally 
cleared to review this material. It is not clear whether 
some or all of these programs may be encompassed in the 


new APEX (and[___] system(s)-[ | 


c. These handbooks* should be published at each phase 
of the APEX implementation schedule to assure that commmity- 
wide understanding, and more importantly consistency, is 
achieved. The proposed manual offers general guidelines, but 
‘does not attempt to explain step-by-step implementation pro- 
cecures, The D/S&§T was advised earlier that it is anticipated 
that many months of briefings and training by representatives 
of the Security Committee would be necessary to accomplish 
this task, and in its view this material could best be pre- 
sented in the form of implementation handbooks.[__] 


‘Directorate Positions. -- D/O: 
8. With respect to the Security Manual for Industry -- 


a@. All reference to the [| compartment should 
be deleted from this manual. Page 1, I. INTRODUCTION, 
third paragrapn, delete "and_the especially sensitive 
material designators in the[___]category."" This 
‘tecomendation is made on the basis that [___]material 
is not appropriate for dissemination to contractors. 

is not mentioned elsewhere in this manual. 


b. It is noted that the document numbering systems 
for contractors and Government differ, which is bound to 
result in confusion arid compound the complexity of the 
system. Therefore, it is recommended that both contrac- 


tors and Government_use the ACS-prefix for the document 
mumbering systen.[_ 


*® Published for each major subject, 1.e., access approvals, classifica- 
tion guidelines, document controls, etc., that develops during the 
preimplementation process is one possibility to assure community-wide 
consistency. 
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9. And with respect to the Security Manual for Government -- 


’ a. The sensitive material designators for infor- 
mation in theL____lcategory should be classified. It 
is recommended, therefore, that the second paragraph, page 
1, I. INTRODUCTION, Line S be changed to read as follows 
after the word TECHNICAL: "The codewords that identify 
_ highly sensitive collection projects and the sensitive 
Material designators for the] compartment may be 
used outside the APEX control system but must be pro- 
tected by the standard classification level of 
CONFIDENTIAL." 


_b. Page 5, Section VI.[___}-Add the following 
‘sentence to paragraph 1: [_____|material may not be 
provided to contractors.""([_ 


c. . Page 7, c.4.(b) Storage--Add the following | 
sentence to bring the protection in line with 
‘the current approved handling of sensitive HUMINT, 
“which has been designated for inclusion within the 

compartment: "Storage facilities in separate 
and dedicated rooms may be required for designated 
[____]eategories at the discretion of the originator." 


d. Page 24, g. Reproduction--Add to second 
_ paragraph: CI compartment material may not be 
- reproduced. Additional copies must be obtained from 
the originator.” 


_.e. Page 26, a. Automatic Data Processing--Add 
the following:[_____]controlled material may not be 
included in ADP systems." 


_f£. Page 27, c. Microfiche--Add the following: 
controlled material may not be included in 
. microfiches." [_] 


. Page 27, d. Microfilm--Add the following: 
co controlled material may not be included in 
microfilms." 
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10. These comments reflect the D/O's concern for the han- 
ailing and control of sensitive HUMINT information that will appear 
25X1 -in the[____|compartment. The general provisions of the security 
“manuals were previously coordinated with ‘the D/O, and contain — 
“basically the same information and restrictions as are now in 
effect. for the various SCI compartments. [| 25 


_. Directorate Positions. -- D/A: 


Il. There is an absence of any mention of establishing billets 
“within the APEX Control System corresponding to positions -where the 
_ "need-to-know’' access to APEX-controlled information can be predeter- 
mined and justified. Whether this was deliberate in the belief that 
»4t-would further complicate the. systems. is unknown. . The idea of a 
billet system is not new for it would provide a mechanism whereby — 
“the APEX Special Access Control System could be policed and permit 
“@asier. periodic evaluation of an organization's access require- 
25X11 ments. : a : 


a “12. “With respect to aspects of records and classification manage- 
“ment, the D/A has identified the following problem areas. 


a. The manual should be portion marked to be in 
-conformance with section 1-504 of Executive Order 12065.[ 5 


-b.. Section XIII.b.6. provides a classification auth- 
ority-and duration marking (described as a "Declassification 
“Review Notice'’) for all APEX materials. ~The elements of the 
“narking consist of: = a 


= -- the identity of the classification authority by 
‘the use of "CLASSIFIED BY", 


e+'the date for declassification review by the use 


of "REVIEW ON", -or "REVW" in electrically transmitted 
messages, and 
_ > the reason for classification is extended be- 
yond 6 years by the use ‘of "REASON FOR EXTENDED 
25X14 CLASSIFICATION. ae 


. (1). The above is incomplete. ‘Most notably there is 
‘missing a requirement to identify the office of origin and 


se 
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the official who authorized the classification extension 

“beyond six years, as specified in E.0. 12065, sections 

1-501 and 1-502. Additionally, section 1-501 (c) of the 

Order provides for an event of declassification as well 
25X1 as a date. 


* (2) An additional concern is that if this portion 
of the manual becomes obligatory, CIA regulations on 
classification markings will have to be amended either to 
eliminate the -markings currently in effect or to add the 

“new ones. No matter which way it is done, the end result 

- will be a system of markings that is not as good as the 

_ one CIA has; this is probably true in other Government 
25X1 agencies as well. a 


. (3) The D/A suggests that instead of dictating what 

all the nation21 security markings on APEX materials are 

to be the manual state only that the markings must be in 

conformance with Agency requirements under E.0. 12065 for 

non-APEX (collateral?) material, and spell out only the 

‘requirements such as codeword designations that are unique © 
25X1 to APEX. 


c. Section XIII.f. states that as soon as possible 
after its purpose has been served, all APEX-controlled 
- material will be destroyed. Destruction times are also 
“provided in the seventh and eighth paragraphs of this 
.game section under h. 


(1) Title 44 USC 33 and FPMR 101-11.4 require 
that destruction of records be approved by the Archivist 
of the United States in the form of records control 
schedules. Any destruction of records without this 


25X1 approval is illegal. 


d. Section XIV.b. needs clarification. Should slides 
- be labelled on the images themselves or on the slide mount? 
If the slide mount needs to be labelled, it will be very 
labor-intensive. Should the film.negatives and/or negative 
holders be marked? Also, it appears that instead of metal 
- containers, what is really meant is opaque containers. Most 
£ilm containers are now plastic and may be either opaque or 
25X1 transparent. 
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e. Does section XIV.d. mean that a classification 
eye-readable target should appear before and after each 
document on the roll of film? If so, this is not possible 

- on COM-produced material and would require a lot of time 

_and. effort on source document-produced material. Addition- 

ally, not.all.QOM recorders will produce. eye-readable titles 
25X1 -on roll film. L___] 


13. The. Office of Commmications has reviewed the draft of the 
_ subject manual and requests the following changes thereto: 


a. Page 18, Paragraph X.c. Delete the draft para- 
graph and replace with the following: 


_ "c, Compromising Emanations Control (TEMPEST 
“sSecurity). All equipment and facilities used to. 
‘transmit or process APEX information electrically, 
“including commmications, word-processing and 
-.autématic.data-processing systems, must satisfy the 
requirements of: 


“1. .MIL-HDBK 232 - RED/BLACK Engineering - 

Guidelines. Note: -MIL-HDBK 232 will be used 

a _amtil NACSEM 5203 - TEMPEST Guidelines for 
Facility Design is.published at which time the 
“‘Jatter. document will replace MIL-HDBK 232. 


°2. -KAG-30 - Compromising Emanations Standard 


-for Cryptographic Equipment. Compromising 
“gmanations from equipment and wire lines pro- 
~ essing APEX information mst be contained 
‘within a control zone that is under sufficient 
"physical and technical control to preclude a 
‘successful hostile intercept attack.” Cid 25 


ab. Page 23, Paragraph XIII.d. Modify as indicated 

below: 

‘ig, Electrical Transmissions". "APEX material 
transmitted..." no change to draft. 


“The transmission of APEX..." delete and 
replace with: "Electrical transmission of 
‘APEX information shall be limited to specifically 
‘designated and accredited commmications circuits 
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secured by a government-approved cryptographic 
system and/or protected distribution systems. 
Electrical commmications facilities used for 
the transmission of APEX information shall be 
accredited by the cognizant APEX Security 
Officer in coordination with the department or 
agency commmications security activity." 


"Electrical transmission of APEX..." delete. 


"Material transmitted by accredited...'' no change 
_ in draft. 


"The first item...'' no change to draft. [| 
14. The above changes are necessary to: 


a.  Make-the document more specific and hence, more 
useful to the user; 


b. Eliminate citations of outdated policy documents; 
and, 


c.. Delegate electrical transmission equipment, and 
facility accreditation from the DCI to the cognizant APEX 
Security Officer in coordination with his or her support 


25X1 _- ing COMSEC activity.[/ 


15. OC notes that the appendices that are listed in the table 
of contents and mentioned throughout the text are not included in 


25X1 ‘the manual. [_ 


16. In addition to the specific language changes requested in 
- paragraphs 13.a and 13.b above, OC has these general concerns: 


a. Page 5, Paragraph h. Consideration should be 

given to removing the examples of personnel cited in 

' Phase I and Phase II to eliminate confusion at a later 
date. The definitions of Phase I and II could end, in 
both cases, after the first sentence. The inclusion of. 
commmications personnel in Phase I is not, for example, 

a good illustration. Most commmicators who process 
APEX information do have access to substantive APEX 
material. 


15. 
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b. Page 24, the 4th subparagraph of Paragraph ds 
It is assumed that the requirements for marking electrical 
‘transmissions as stated will not preclude the printing of 
=the acronym APEX on the side of each disseminated cable to 
-replace the "SCI" acronym currently used. = 25 


- ¢, Page 24, subparagraphe. It is assumed that the 
requirement for cover sheets does not extend to cover- | 
Sheeting. cable_receipts. If it does, the Cable Secretariat 
Branch of OC' would require 
“sadditional personnel resources to acco te coversheeting. [ 25 


ad. Page 24, subparagraph f. It is assumed that the 
_-requirement to maintain destruction records does not include 
“Cables, routinely destroyed during processing and reproduc- 
“tion within the Cable. Secretariat Branch. am 


25 


—"e, - Page 24, subparagraph g. The requirement that per- 
.. ‘mission be obtained to reproduce Top Secret APEX material 
~ should not include cables. If it does, again, there would be 
‘gerious. resources implications for the Cable Secretariat 
“Branch, and unnecessary time delays in the centralized cable 
dissemination activity. Suggest that cables be excluded from 
this requirement. I 


:47. Although the foregoing comments are offered in the context 


cof the CIA Cable Secretariat, the same concerns would probably be 
Shared by cable dissemination centers throughout the Intelligence 


“yg. The Office of Data Processing finds the manuals well written 


“anc-clear, for the most part, but the depth of treatment of various 


“aspects of APEX is uneven. It assumes subsequent manuals or hand- 
- Books within member agencies will provide working-level guidance. 
 ODP's area of greatest concern, naturally, is ADP. The simple 
_gtatement on computer security in para. b. of Section X, while 
“reasonable on the surface, is a dangerous gloss. DCID 1/16 is not 
--a-completely workable directive at this time, nor is it expected to 
Be in the near future. The DCI's covering memo (effective 6 June 
_ 1978) on the current version of DCID 1/16 recognized this fact by 
“$tating: 
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The diversity and complexity of such computer 
systems now in place in the Commmity and 
those designed for future placement may not 
provide for compliance with the requirements 
of the directive in their entirety. Recog- 
nizing both the validity of the requirements 
‘and the difficulty involved in their applica- 
tion to currently installed and already 
designed ADP system, the extent to which the 
exceptions to the requirements of this 
Directive are applied to such systems is left 
to the determination of each National Foreign 
Intelligence Board (NFIB) member in view of 
his ultimate responsibility for the protection 
of intelligence information. 


The implementers of APEX should be aware that DCID 1/16 was written 
_- with the full knowledge that CIA computer systems (existing and 

planned) could not comply in a strict sense to all its provisions, 
particularly if SCI or APEX information was involved. 7 . 


19. Areas of principal concern for ODP are access approvals 
for ADP personnel programming and operating computer systems that 
-process APEX material, access approvals for users of computer sys- 
tems that process APEX material, marking and control of hard-copy 
- (printer) output that is APEX-controlled, marking and control. of 
magnetic media containing APEX data, and header information for 

-jaicrofiche or COM output of APEX data 


‘a. | ODP's current practice for SCI-access approvals 
for ODP personnel is to give everyone SI/TKL___and to 
Tequest individual compartment accesses for those with a 
need to know because of projects they are working on. How 
this would be handled under APEX is not clear. [| 


“bs. Until recently, because ODP could not ensure 
that ODP terminal users would not be exposed to SCI 
material accidentally, they were required to have SI/ 

“TK access also. The Office of Security relaxed this 
requirement so that only those terminal users who 
‘actually process SCI material are required to have SCI 
accesses. Again, how this would be handled under APEX 


is not clear. = 
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¢. Classification and SCI markings on hard-copy 
(printer) output from ODP computer systems is currently 
‘the responsibility of the person initiating the computer 
=program producing the output. ODP provides users with 
utility programs to facilitate these markings but 
accepts no responsibility for ensuring their use. Com- 
puter printouts containing SCI material are normally 
treated as uncontrolled "working papers" when they are 
_ released to users at ODP distribution points. If 
the material is to be logged and controlled, the ODP 
user assumes this responsibility. How APEX markings 
and document control for computer printouts will be 
handled needs to be clarified.[_ 25 


_ «-d, SCI handling of ADP magnetic media as 
described in Section XIV, para. a., is a current 
requirement, .but CDP. does not do it for material 
“tbhat.stays within its computer centers. The ration- 
-ale is that the computer centers. and their attached 
. ‘tape libraries constitute secure controlled areas 
_(AFCs under APEX); therfore, marking magnetic media 
stored ‘within these areas serves:no purpose. It is 
-only when. magnetic media are removed from computer 
‘centers that external. marking must be placed on the 
media and their container. We assume ODP will be 
“g@liowed to continue this practice under APEX. Cid 95 


? ve. ~ CIA currently produces large volumes of 
SCI material on microfiche, roll microfilm, and COM. 
‘To ODP's best knowledge, none of the systems producing 
“these microfilm images provide for human-readable 
headers of the type described in Section XIV. para. b., 
c:, and d. -Implementers of APEX should be aware that 
‘the CIA will incur a large conversion cost, in dollars 
-and manpower, if this aspect of APEX is strictly 
“enforced. In addition, a major system now in develop- 
sment, “ADSTAR for NFAC, cannot comply with these pro- 


25X1 wisions. 

25X1 20. Will[___] material be excluded from ADP systems? ODP 
“infers from Section VI. para. c. that it will, but this.should: be 

25X1 -clarified.[- . 
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21. What is the APEX policy on polygraph interviews of per- 
sonnel being granted access? Section VIII. paragraph d., subpara- 


graph 13. leaves room for this requirement but does not state it 


explicitly. ODP would argue strongly for polygraphs for personnel 
| | 25 


22. Section IX. paragraph b. is somewhat ambiguous as to who 
does accreditation for whom. Possibly better punctuation would 
Clarify this point. 


yo Representatives of the Office of Security have submitted 
comments and suggested changes to previous drafts of the APEX 
Security Manuals, some of which appear to have been incorporated 


_ in the most recent draft, some of which have not. This memorandum 
‘does not reiterate those previous suggested changes relating to 
Syntax, grammar, or minor alterations. OS, however, does wish to 


express a general concern regarding the lack of a ema of 


the manuals and also suggest three specific changes. 25 


24. Regarding the lack of specificity, one of the most re- 


‘curring comments received by representatives of the Office of 


Security during discussions with corporate security officers is 


- the lack of uniformity among the various Intelligence Commmity 
. Customers concerning security procedures or directives. These 


corporate representatives express a desire to have a manual that 


_ provides specific policies, procedures and detailed guidance that 


can uniformly be applied to various SCI customers. The proposed 


‘Manuals provide guidelines for the security and control of APEX 


material, but agencies are expected to "continue to provide basic 
direction and classification guidance.'' There are several instances 
of vague terminology in the manual, e.g., "timely submission," 


_"as soon as. possible," '"'as soon as feasible,"’ etc., which beg the 


issuance of a host of implementing directives--probably in conflict 
with one another--from several Government agencies engaged in 
compartmented activities and which may well result in a lack of 
uniformity.[" | 


25. Three specific changes requested by the Office of Security 
are as follows: _ ; 
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a. Courier Procedures. The proposed manuals prohibit 

_ ‘transmittal of APEX material via non-US. Government-operated 

or charter aircraft: except when the Armed Forces Courier 
“Services (AFGOS) are used. The Security Staff, OD§E/DDSET, 
-operates an extensive courier system that carries a largs 

volume of SCI material on both domestic and international air 
‘routes. They are required to utilize commercial air carriers 
_frequently.. In addition, professional security officers of 

“the Office of Security are occasionally dispatched in response 
to special courier requirements and require use of commercial 
“air carriers. It is requested that the restriction on trans~- 
“mittal of APEX material via non-US Government-operated or : 

chartered aircraft be removed. 25 

‘b. Termination Secrecy Agreements. The manuals require | 

“Termination Secrecy Agreements executed for individuals ‘being 
“-@ébriefed° from APEX access. The Office of Security endorses 
“this concept, but requests the form be entitled Termination of 
“eAccess/Security Reminder vice Termination Secrecy Agreement. 
“This is compatible with recent legal decisions that the term 

MSecurity Reminder”’ is preferable to a "Secrecy Agreement" 

because there really is no valid agreement (i.e., contract) 

upon termination owing to a lack of consideration, in the 

‘Jegal sense. The Office of Security is in the process o 


7 
having the present form revised along the lines suggested. [| 25 


.¢. Congressional Access. Section XVI, paragraph 5, page 
20, of the Government manual states requests for exceptions to 
‘clearance standards in ‘the case of nonelected persons in the 
_ Legislative Branch should be referred to the ICI Legislative 
_. Counsel for resolution. The Office of Security takes the 
‘position that exceptions to clearance standards are not the 
prerogative of the Legislative Counsel although OLC could be 
_ #the ‘channel for obtaining an exception. Therefore, OS 
“recommends the words "for resolution" be deleted. [sid 25% 
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SUBJECT: APEX Security Manuals for Government/Industry--CIA 
Comments 


DISTRIBUTION: 


Addres 
D/NFAC 
D/OCO 


D/OSR 

D/OGCR 

D/OWI 

D/OER 

D/OPA 

D/OSI 

D/OIA 

D/OCR 

C/PPG 

C/Admin Staff 


Executive Registry 

NFAC Registry 

is Chrono 

- RES/SPG Project File (APEX) 
1 - RES/SPG Chrono 


NFAC/RES/SPGL____ jp: 160cttober 1979 


1 
1 
1 
a 
1 
1 
1 
1 
id 
1 
i 
1 
1 
1 
3 
‘] 
5 
1 
1 
1 
1 
1 


eo 


OONFIDENTIAL 
Approved For Release 2004/05/12 : CIA-RDP85T00788R000100060010-7 


